1. Field of the Invention
The present invention relates generally to broadcast data encryption, and more particularly to the encryption of recordable media to permit the media to be copied once only.
2. Description of the Related Art
The advantages of digitized video and music are numerous, but one significant drawback is that being digitized, the content is relatively easy to copy perfectly, without authorization of the copyright owner. Copies can be made of digital audio and video content that is broadcast to in-home receivers over a network such as, for example, Home Box Office (HBO), or that is provided to in-home users on media such as digital video disks (DVDs). Indeed, widespread copying by pirates costs content owners billions of dollars per year. Thus, the present invention understands that it is desirable to limit the unauthorized copying of digital audio and video.
The problem, however, is complicated by the desire of governmental bodies and consumer protection lobbies to permit a buyer of digitized content to make a single copy for archive purposes or other legitimate reasons. Accordingly, the problem addressed by the present invention is how to enable a buyer to copy a broadcast program, but once only. It is to be understood that while today the requirement is to make only one copy, in the future the requirement might be to allow two or more copies. It is to be further understood that any solution solving the xe2x80x9ccopy oncexe2x80x9d requirement could be trivially extended to any specified number of copies; the invariant feature of any solution is to make sure that a copy cannot be further copied. For convenience and clarity, the present disclosure assumes that only one copy is to be made, it being understood that limiting the number of permissible copies to any finite number is within the scope of the present invention.
To better understand the problem, if every recorder in the world were an authorized, properly programmed recorder, a broadcast program could simply contain an unencrypted signal indicating xe2x80x9ccopy oncexe2x80x9d, and each recorder used for copying would duly copy the content and append an unencrypted message to the copy indicating xe2x80x9ccopy no morexe2x80x9d. Any player could play the copy, but any recorder sought to be used to recopy the content would obey the xe2x80x9ccopy no morexe2x80x9d message, protecting the rights of the content owner.
Of course, pirate recorders can be constructed that do not obey such procedural messages. Consequently, a cryptographic approach must be used to prevent unauthorized usable copies from being made. One approach recognized herein is to provide each authorized recorder with its own secret key, which the recorder would use to encrypt the content. Unfortunately, the media so recorded could be played back only on the player that is associated with the recorder that made the copy, so this approach is unacceptable in the consumer market.
Alternatively, the present invention understands that a single secret key could be provided to all recorders, which would then use the key to encrypt the content as it is recorded. In this way, any authorized recorder that includes a player could play back the recording, regardless of where the recording was made, and authorized recorders could be programmed to copy any broadcast program only once. Current DVD encryption methods use this approach. The drawback with this method is that it is cryptographically fragilexe2x80x94once the system secret is discovered by an unauthorized person, it can be disseminated to unauthorized pirate recorders that could use the key to copy the content thousands of times, unencumbered by what amounts to a promise to copy a broadcast program only once, and thereby defeat the system.
As recognized herein, a one-way key management scheme can be used which has a good key management method to address the above-noted problem of unauthorized recorders being provided with a stolen system key. One-way key management is a cryptographic protocol in which two parties can agree upon a key without having two-way communication. Good one-way key management protocols also have the feature that illegal clones that have some of the secrets in the protocol nonetheless can be excluded from interoperating from the legitimate devices. One such system is disclosed in IBM""s co-pending U.S. patent application Ser. No. 09/065,938, filed Apr. 24, 1998 for an invention entitled xe2x80x9cSystem for Encrypting Broadcast Programs in the Presence of Compromised Receiver Devicesxe2x80x9d, incorporated herein by reference. However, such a system, in and of itself, is not sufficient to address the current problem. This is because a pirate, although unable to discover the key and decrypt the data in the broadcast program or on the DVD, can simply make a bit-for-bit copy of the encrypted data. The pirate recorder itself could not decrypt and play the data, but any legitimate recorder-player would be capable of decrypting and playing the unauthorized copy, thus making the copy salable.
The present invention has carefully considered the above considerations and has addressed the noted problem.
A system is disclosed for once-only copying of data representative of video and/or audio to one of a plurality of data storage media. Each data storage medium includes a respective media identification written to an ID location on the medium, and each medium also includes a common one-way key management media key block. In accordance with the present invention, the system includes a program of instructions that include structure for undertaking method acts including, for each medium, determining a media key from the common one-way key management media key block. Also, the present method acts include combining the media key with the media identification to render a content key, and then encrypting the data using the content key for copying of the encrypted data onto a data storage medium.
Preferably, a player-recorder establishes a player and a recorder, and the player-recorder undertakes method acts including sending encrypted data from the data storage medium to the player. The media identification and media key block on the data storage medium are read by the player. Then, the media key is determined using the media key block, and the content key determined using the media key and the media identification. With the content key, the player decrypts the data to facilitate the player playing video and/or audio represented by the data.
As envisioned by the present invention, to facilitate copying the data storage medium one time only, the method acts can further include establishing an exchange key between the recorder and a sender selected from the group of senders including: the player, and a broadcast program receiver. The exchange key is then modified with one or more special numbers to render a modified exchange key, with the special numbers representing the group of control commands including: copy once, and copy no more. Moreover, the method acts include encrypting the modified exchange key using the content key to render an encrypted modified exchange key, and using the encrypted modified exchange key or a derivative thereof to encrypt the data for copying thereof to the data storage medium. In a particularly preferred embodiment, the encrypted modified exchange key is hashed with a nonce to render a bus content key, with the bus content key then being used to encrypt the data for copying thereof to the data storage medium.
The preferred one-way key management scheme can include accessing plural computer-usable device keys selected from a set of device keys. The media key block is generated by encrypting plural media numbers with the set of device keys, with at least one of the media numbers being a dummy number when it is determined that at least one recorder is a compromised recorder defining compromised device keys. Under these circumstances, the dummy number is encrypted by at least one compromised device key. The recorder determines the media key based on the media key block and the respective device keys, such that the media key is usable to decrypt the data unless the dummy number is used to generate the media key.
As disclosed in the above-referenced patent application, the set of device keys is representable by at least a two-dimensional matrix including a key dimension and a sets dimension. The key dimension represents xe2x80x9cNxe2x80x9d key positions each represented by a key index variable xe2x80x9cixe2x80x9d, and the sets dimension represents xe2x80x9cMxe2x80x9d sets each represented by a sets index variable xe2x80x9cjxe2x80x9d, such that each device key can be represented by Sj,i. In the preferred encryption scheme, no two device keys of a recorder have the same key index variable xe2x80x9cixe2x80x9d as each other.
A respective media number is provided for each key index variable xe2x80x9cixe2x80x9d such that each media number can be represented by xi. Each media number xi is encrypted only by device keys in the ith key dimension. Each recorder uses its respective ith device key Sj,i to decrypt the ith media number, such that all recorders not having the compromised device key generate at least a first media key and all recorders having the compromised device key generate at least a second media key, only the first media key being useful in decrypting the data.
Furthermore, recorders generating the first media key define at least a first pool and recorders generating the second media key define at least a second pool, and renewal data is sent to the recorders in the first pool when all recorders in the first pool are not compromised. The recorders in the first pool operate on the renewal data to generate new device keys. In contrast, if recorders in the second pool are not compromised recorders, the recorders in the second pool are caused to generate a new media key. Still further, a first set of non-compromised recorders defines a first pool and a second set of non-compromised recorders defines a third pool such that each of the first and third pools do not contain any compromised recorder. Recorders in the first pool are caused to replace their media key with the media key of the recorders in the third pool.
In another aspect, a computer is disclosed that includes a program of instructions for causing a media manufacturing machine to write, onto each blank media device of a plurality of blank media devices, at least one computer-readable media identification and at least one computer-readable one-way key management data block. As envisioned herein, the media identification of a media device subsequently can be combined with at least one key derived from the encryption data block to render a content key for use in encrypting data to be recorded on the media device.
In still another aspect, a computer-implemented method for enabling data to be copied one time only onto a media device includes writing at least one media identification and at least one one-way key management key block onto the media device. At least the media identification is written in a read-only area. A media key is derived from the media block and combined with the media identification to render a content key. Then, an exchange key is established between a recorder and a sender having access to the data. Desirably, the exchange key is modified using at least one special number representing a copy command to render a modified exchange key, which is then encrypted using the content key to render an encrypted modified exchange key. Using the encrypted modified exchange key or a hash thereof, the data is encrypted for copying the encrypted copied data once only to a copy media device, such that the encrypted copied data can be decrypted and displayed but not recopied without access to the special number.
In yet another aspect, a recorder computer program storage device includes a program of instructions for writing data representative of video and/or audio to a digital disk, with each disk including a respective media identification written to an ID location on the disk. The disks also include a common one-way key management media key block, and the program of instructions includes computer readable code means for, for each disk, determining a media key from the common one-way key management media key block. Further, computer readable code means combine the media key with the media identification to render a content key. Also, computer readable code means for encrypt the data using the content key for recordation of the encrypted data on the disk.
In another aspect, a user computer program storage device is accessible by a player-recorder establishing a player and a recorder. As disclosed in detail below, the user computer program storage device includes computer readable code means for sending encrypted data from a data storage medium to the player. Computer readable code means read a media identification and a media key block on the data storage medium, and computer readable code means then determine a media key using the media key block. Additionally, computer readable code means determine a content key using the media key and the media identification, such that computer readable code means can decrypt data on the data storage medium using the content key to facilitate the player playing video and/or audio represented by the data.
In still another aspect, a blank data storage disk is provided for recording digital data thereon. As intended by the present invention, the blank data storage disk includes a media identification that is substantially unique to the disk. Also, the blank storage disk includes a media key block for facilitating copy-once recording.
The details of the present invention, both as to its structure and operation, can best be understood in reference to the accompanying drawings, in which like reference numerals refer to like parts, and in which: